The 911 SOC must protect CAD-to-radio-gateway traffic before writing Distributed Firewall rules. What identification step comes first?

Before the 911 SOC writes Distributed Firewall rules for CAD-to-radio-gateway traffic, the first identification step is to document source, destination, and services for that unique flow, then build groups. You cannot write a good fire code for a hallway you have not mapped: inventory the conversation before encoding policy. Publishing an any-any Emergency rule named CAD so identification is unnecessary fails by concept because a named any-any skips scoping, hides required ports, and turns Emergency into a permanent blind allow that auditors and operators cannot justify. Converting the radio gateway to a T0 VRF-lite design from VCP-NV fails because routing topology redesign is not the identification step for an application conversation and conflates network virtualization design with security flow labeling. Filing a CISSP residual-risk memo instead of labeling the conversation fails because a GRC memo does not produce NSX groups, services, or enforceable Distributed Firewall rules for CAD. Exam caveat: identify source, destination, and services first, then group and rule; Emergency any-any, VRF redesign, and residual-risk paperwork are not substitutes for flow identification. Operational check: interview CAD owners, capture IPs/FQDNs and ports for CAD and radio gateway, create dedicated groups and a service object, draft least-privilege Distributed Firewall rules, Traceflow the path, and store the flow sheet in the 911 security inventory before publish.